Heuristics.phishing.Email.SPoofedDomain

For fastest, most efficient answers to questions such as this visit the ClamXav Forum.

The infected files you have found are totally unrelated to your inability to access the internet, but I can give you some information on what you have found.

"Heuristics" referred to here means that they are from or mention a financial institution and "SpoofedDomain" means it contains hyperlink(s) that are not known to be associated with that organization and may be a phishing attempt which is trying to obtain privacy information (e.g. UserID and Password credentials). It has not been positively identified as such, just that something about the format of one or more links is suspicious. You can see exactly where a link will take you by hovering the cursor over the underlined words or image in the e-mail. Don't click the link unless you are certain that it will take you to a legitimate site. There is a significant probability that these are legitimate e-mail messages from a financial institution that you need, so trashing them could very well be a mistake. The only way to know is to read them. There is also a distinct possibility that you or your e-mail system have already decided that they are spam / junk / phishing and they came from your Spam / Junk / Deleted Items / Trash folders, so you should always check to make certain they are not needed and then delete them before running an e-mail scan.

The most recent versions of ClamXav will not move e-mail to your quarantine folder, despite what it told you.

Never use ClamXav (or any other A-V software) to move (quarantine) or delete e-mail. It will corrupt the mailbox index which could cause loss of other e-mail and other issues with functions such as searching. It may also leave the original e-mail on your ISP's e-mail server and will be re-downloaded to your hard drive the next time you check for new mail.

When possibly infected e-mail files are found:

• Highlight the entry in the ClamXav window's top pane that needs to be dealt with.
• Right-click/<Control>-click on the entry.
• Select "Reveal In Finder" from the pop-up menu.
• When the window opens, double-click on the file to open the message in your e-mail client application.
• Read the message and if you agree that it is junk/spam/phishing then note the date and subject of the message and close the e-mail window. Now, using your e-mail client, locate that message in whatever mailbox folder it was found in and delete the message using the delete button. Reading it is especially important when the word "Heuristics" appears in the infection name.If you disagree and choose to retain the message, return to ClamXav and choose "Exclude From Future Scans" from the pop-up menu.
• If this is a g-mail account and those messages continue to show up after you have deleted them in the above manner, you may need to log in to webmail using your browser, go to the "All Mail" folder, find the message(s) and use the delete button there to permanently delete them from the server. Then check the "Trash" folder and delete them there.

Cmhaft wrote:

What I did was right click.... it didn't give me the option to reveal in finder. It gave me the option to clear so I did

Sorry, but I don't understand. There is no "clear" option with the ClamXav application. See Dealing with Infected Files. Are you perhaps using ClamXav Sentry which has an "Infected Items Window" that allows you to clear any detections.